Suspicious
Suspect

5c84cc24fc6c7feb21bc68b3c84d686f

PE Executable
MD5: 5c84cc24fc6c7feb21bc68b3c84d686f
Size: 174.59 KB
application/x-dosexec

This sample is a 170.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
7037a728d1eec6d7437349589ea39ab283d0b155cf3f26bb7a7d422ba3336b2e
MD5
5c84cc24fc6c7feb21bc68b3c84d686f
Verdict
Inconclusive
File type
PE Executable · 170.5 KB

Cite this report: https://app.malva.re/sha256/7037a728d1eec6d7437349589ea39ab283d0b155cf3f26bb7a7d422ba3336b2e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
174.59 KB · 174,592 B
First seen
2026-09-22 11:00 · one month ago
Last seen
2026-09-22 11:00 · one month ago
Last analysis
2026-09-22 11:00 · one month ago
Hashes
MD5 5c84cc24fc6c7feb21bc68b3c84d686f Sha1 d24cf8772b9b009c1f62210fa0df3e4569793e03 Sha256 7037a728d1eec6d7437349589ea39ab283d0b155cf3f26bb7a7d422ba3336b2e Sha384 6c3401af5b6cf08af8dcf5d2b62429fed7ca999acd493b20bd9faa3436179e2f72de97ea43527fdfaeeca89ccf841764 Sha512 0e96fdc76991ae8ced5e734d68d14e860331ff8d9321401e8744cf0c55689f934ba5c1e13303e7125cd7108375996389363623666484ca04854845f78957dc5d SSDeep 3072:kNlhOHmsbpzY+bRtrPajG3a2xL6yyXzKbenf8Cft3Ng6NQdlkxuKflXMyKhcc4ih:CCPrLaj12xxwzKONg62d2xuKfJMyKydT TLSH C704F104EBF04658E5BC6F7268B5411983B3B353B932DB2D0B86918F1B733818D6277A
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

4 files
EXE5c84cc24fc6c7feb21bc68b3c84d686f
Structure
BIN.Net Resources
BINBeautiful.Properties.Resources.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
Beautiful.exe
Full Name
Beautiful.exe
EntryPoint
System.Void Beautiful.Program::Main(System.String[])
Scope Name
Beautiful.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Beautiful
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
241
Main Method
System.Void Beautiful.Program::Main(System.String[])
Main IL Instruction Count
72
Main IL 
nop <null>
call System.String Beautiful.Properties.Resources::get_database()
stloc.0 <null>
ldc.i4.0 <null>
newarr System.String
stloc.1 <null>
ldarg.0 <null>
brfalse.s IL_0018: ldc.i4.0
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
br.s IL_0019: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_0035: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 32
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.1 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] System.Convert::FromBase64String(System.String)
call System.Byte[] Beautiful.Program::Imagination(System.Byte[])
stloc.2 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.2 <null>
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
stloc.3 <null>
ldloc.3 <null>
ldstr Discovery.Opportunity
callvirt System.Type System.Reflection.Assembly::GetType(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
stloc.s V_7
ldloc.s V_7
brfalse.s IL_006A: ldloc.s V_4
br.s IL_00A0: ret
ldloc.s V_4
ldstr Creativity
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo)
stloc.s V_8
ldloc.s V_8
brfalse.s IL_0088: ldloc.s V_5
br.s IL_00A0: ret
ldloc.s V_5
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>
Info
PDB Path: ?
Module Name
Beautiful.exe
Full Name
Beautiful.exe
EntryPoint
System.Void Beautiful.Program::Main(System.String[])
Scope Name
Beautiful.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Beautiful
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
241
Main Method
System.Void Beautiful.Program::Main(System.String[])
Main IL Instruction Count
72
Main IL 
nop <null>
call System.String Beautiful.Properties.Resources::get_database()
stloc.0 <null>
ldc.i4.0 <null>
newarr System.String
stloc.1 <null>
ldarg.0 <null>
brfalse.s IL_0018: ldc.i4.0
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
br.s IL_0019: stloc.s V_6
ldc.i4.0 <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_0035: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 32
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.1 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] System.Convert::FromBase64String(System.String)
call System.Byte[] Beautiful.Program::Imagination(System.Byte[])
stloc.2 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.2 <null>
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
stloc.3 <null>
ldloc.3 <null>
ldstr Discovery.Opportunity
callvirt System.Type System.Reflection.Assembly::GetType(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
stloc.s V_7
ldloc.s V_7
brfalse.s IL_006A: ldloc.s V_4
br.s IL_00A0: ret
ldloc.s V_4
ldstr Creativity
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo)
stloc.s V_8
ldloc.s V_8
brfalse.s IL_0088: ldloc.s V_5
br.s IL_00A0: ret
ldloc.s V_5
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>

4 files
EXE5c84cc24fc6c7feb21bc68b3c84d686f
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙